A screengrab taken on Monday from the homepage of online mapping company Earthware. Health authorities have launched an investigation into the site

A service offered by a data mapping website was closed down on Monday, as health authorities launched an investigation into the site amid concerns it had apparently acquired millions of identifiable patient records without regulatory scrutiny.

A Hertfordshire-based online mapping company, Earthware, which offers services including property data, hosted a tool which could allow users to locate an area in England where a single individual had gone for specialised treatment.

Although this would not necessarily pinpoint the patient involved, the risk of identification is considered so high that data protection rules prohibit the release of information when fewer than five individuals are involved. The website offered a free service to sample the tool's usefulness, which allowed the public to search for heart and respiratory conditions.

A spokesman for the information centre said: "The link to this tool has been taken down following a request by the HSCIC. We are investigating urgently the source of the data used and whether controls demanded of any organisation using data have been maintained. After this investigation we will take any necessary action."

It said that the map displayed mock data held by a third party; that the company had never held HES data on its servers and that no patient-identifiable data was ever displayed on the map. "We will continue to co-operate fully with the HSCIC if required," it concluded.

The investigation comes amid concerns that there are potentially companies in the UK able to create data dossiers on patients by tapping new technologies to unearth ever more intimate information about the public. The dataset apparently came from hospital episode statistics, which hitherto had been considered a relatively "safe" repository of sensitive data.

NHS England has previously defended its flagship care.data scheme – which proposes to extract data from GP surgeries – by pointing out that for 25 years hospital statistics had not suffered a major breach of privacy. Roll-out of the scheme was put on hold in February for six months.

Phil Booth of medConfidential, which campaigns on medical privacy, told the Guardian that "NHS England officials have claimed again and again that there has been no misuse of hospital episode statistics. Now a commercial real estate web mapping company appears to be getting access to hospital patient-level data."

Booth called for a "full transparent" disclosure of all the hospital data so far released and called for the care.data scheme to be "halted". "Until there has been a full transparent audit of every release of patient data the entire system that they propose must be halted."

Under care.data, unless patients opt out, the HSCIC will extract a person's NHS number, date of birth, postcode, ethnicity and gender. Once the system is live, organisations such as university research departments – but also insurers and drug companies – will be able to apply to the HSCIC to gain access to the database. If an application is approved then firms will have to pay to extract this information, which will be scrubbed of some personal identifiers but not enough to make the information completely anonymous – a process known as "pseudonymisation".

This week Jeremy Hunt will push through a number of amendments to the Care bill related to protecting privacy.

The coalition will create a new law that would bar any company that obtains patient information under the care.data programme and uses it in a malicious way from ever bidding to use medical records again. Hunt also proposes that the NHS's confidentiality advisory group, which advises the health secretary on accessing confidential patient data without consent – be made a statutory body.

The patient information had been obtained by PA Consulting, which claimed to have secured the "entire start-to-finish HES dataset across all three areas of collection – inpatient, outpatient and A&E".

The data set was so large it took up 27 DVDs and took a couple of weeks to upload. The management consultants said: "Within two weeks of starting to use the Google tools we were able to produce interactive maps directly from HES queries in seconds."

Experts said there were concerns over the fact that data can easily be shared in the Google system - and that the danger of an accidental data leak would have catastrophic consequences for trust.

In a statement PA Consulting Group said it had purchased the data from the predecessor of the HSCIC. "The data set does not contain information linked to specific individuals. The information is held securely in the cloud in accordance with conditions specified and approved by HSCIC."

The HSCIC said: "PA Consulting used a product called Google BigQuery to manipulate the datasets provided and the NHS IC was aware of this. The NHS IC had written confirmation from PA Consulting prior to the agreement being signed that no Google staff would be able to access the data; access continued to be restricted to the individuals named in the data sharing agreement."

• This article was amended on 5 March 2014 to remove an inaccurate reference to Earthware charging users for each search. The website did not claim to allow users to locate areas where a single individual had gone for specialised treatment, as an earlier version of the article said.